| Event Id | 2 |
| Source | Microsoft-Windows-EventCollector |
| Description | The Subscription %1 could not be activated on machine %2 due to an error. Error Code is %3. Subscription will remain inactive on this target until subscription is resubmitted / reset. |
| Event Information | According to Microsoft : Cause : This event is logged when the subscription could not be activated on machine due to an error. Resolution : Reactivate the event subscription Use the Event Viewer to read the System log.If an event with an identifier equal to 3 is found, then the subscription has expired. This is a normal condition. The subscription should be deleted if it is no longer required, or a new expiration date must be set using the following command from a command prompt run with administrator privileges: wecutil ss SubscriptionID /ex: new expiration /e In the previous command, the SubscriptionID is the name of the subscription. The new expiration specifies the new expiration date of the subscription. If an event with an identifier equal to 4 is found in the System log, then reactivate the event subscription to resolve the problem. The Event Collector service publishes an event with an identifier equal to 4 when all of the event sources of the subscription become inactive. After this occurs, the subscription tries to reconnect to all the sources. If the retries to connect to the sources fail, you can activate each event source separately by ensuring that the event source computers have started, setting the correct credentials to connect to each source computer, and if needed, restoring the WS-Management connection to each source. The Event Collector service publishes event 2 after all retries to connect to the event sources are exhausted, in which case the subscription becomes inactive. After issues with all sources are resolved, enter the following command from a command prompt that is run with administrator privileges (right-click the command prompt executable and select Run as administrator) to reactivate the subscription: wecutil ss SubscriptionID /e In the previous command, the SubscriptionID parameter is the name of the subscription you want to reactivate. Verify : To gather information about the activation status of an event source, enter the following command from a command prompt that is run with administrator privileges (right-click the command prompt executable and select Run as administrator): wecutil gr Subscription ID In the previous command, the Subscription ID is the name of the subscription to which the event source belongs. The command will provide information about the subscription status and will display the activation status of the event source. |
| Reference Links | Event ID 2 from Microsoft-Windows-EventCollector |
Catch threats immediately
We work side-by-side with you to rapidly detect cyberthreats
and thwart attacks before they cause damage.